Malware in KDE Plasma Wallpaper “NeoNova”: How to Check Your PC
If you installed the NeoNova animated wallpaper on KDE Plasma, treat that computer as compromised.
KDE developer David Edmundson warned on 11 November that “NeoNova Animated Wallpaper”, a third-party add-on listed on the KDE Store since 14 October, “is shipping malware”. A user named Serg Star spotted it while reading the code. According to Edmundson, the wallpaper fetches a second script, which drops a shared library into your home folder and starts it. The payload, he writes, “thus far looks like” Sliver, an open-source framework built to control computers remotely.
The wallpaper itself works as advertised: drifting, glowing orbs, with settings for colours and a background image. That is the point. Nobody goes looking for malware in something that looks this harmless.
Why the Code on GitHub Looks Clean
Within hours of the warning, users on KDE’s forum questioned it. The wallpaper’s GitHub repository has one suspicious line, a base64 string the add-on decodes and runs as a shell command. Decoded, it sets four colour values and nothing else.
So we compared the GitHub code with the file the KDE Store serves (version 1.4, NeoNova-Wallpaper-v1.4.tar.gz, downloaded on 11 November at 17:22 UTC). They are not the same. In the store file, the same line carries a longer string. Decoded without running it, it holds the four colours, then a second base64 string, which decodes to a command that downloads a fake “logo” (NeoNova-Logo.png) from the domain fortrana-update.com, decodes it and runs it as a shell script. That matches Edmundson’s “base64 string in a base64 string”.
The timing fits a plan, too. The store listing went up on 14 October. Domain registration records show fortrana-update.com was registered four days later, on 18 October, through Namecheap. The store package was last updated on 24 October.
If you checked the source on GitHub before installing, as careful Linux users are told to do, you checked the wrong file. The download did not match the code you read.
How a Wallpaper Runs Code
Plasma wallpapers aren’t just pictures. A wallpaper plugin is a small QML program that Plasma loads as you, with your user rights. NeoNova uses Plasma’s “executable” data engine, which turns a call in QML into a real process. Two tenths of a second after the wallpaper loads, it runs its bundled shell script, and it does this every time Plasma starts the wallpaper, so at every login too.
What happens next, per Edmundson: the downloaded script fetches a library to ~/.config/Plasma6Library.so and starts it with LD_PRELOAD=~/.config/Plasma6Library.so sleep 999999, which loads the library into a harmless-looking sleep process that just sits there.
None of this needs root. Your files, your browser profiles, your SSH keys and anything your session can reach are available to code running as your user.
Check Your Computer
Signs that the wallpaper is or was installed:
- The wallpaper folder
~/.local/share/plasma/wallpapers/com.local.neonova/exists, or “Neonova” shows up in your wallpaper types. - The file
~/.config/Plasma6Library.soexists. Edmundson calls this “a good test”. - A long-running process
sleep 999999shows up in your process list (ps aux | grep 999999).
If you find any of these, Edmundson suggests “starting anew”, which means reinstalling the system rather than deleting the files and hoping for the best. Once remote-control software has run, you can’t know what else it left behind. Back up your documents (not programs or scripts), reinstall, and then, from a clean device, change the passwords you used on that computer, revoke its SSH keys and API tokens, and log out of your accounts’ other sessions.
Admins can block fortrana-update.com at the DNS or firewall level as a stopgap.
Still Downloadable Hours Later
Edmundson writes that KDE reported the add-on to “all relevant places including Pling and OpenDesktop”, the network that runs the KDE Store, and that they “have taken swift action within hours”. At 17:22 UTC on 11 November, the KDE Store’s public API still listed NeoNova and served the version 1.4 file with the malicious line in it.
How many people installed it is unclear. The store’s public data gives two different download counts for the same listing, 86 in its search results and 2 on the item itself.
The KDE Store Is Not an App Store
This is not the first warning of this kind. In March 2024, a third-party global theme on the KDE Store deleted users’ files. That was a bug, not malware, but the lesson was the same. Edmundson wrote back then that Plasma add-ons can run code, that sandboxing was “slowly improving”, and that curation and auditing of store content were a goal for the future (his 2024 post).
More than two and a half years later, his new post ends on a similar note: “There is only so much we can do with 3rd party content.” He calls it a reminder to be wary of external content, “especially those that run in unsandboxed contents”.
We think KDE is honest about the limits here, and that’s more than many app stores manage. But the store sits inside Plasma’s own settings, and that gives everything on it a look of approval it hasn’t earned. Until add-ons are sandboxed or reviewed, treat a wallpaper plugin like any other program from a stranger. Many Linux users still believe malware is a Windows problem. Malware authors, it seems, have not heard that the Linux desktop is too small a market to bother with.
What We Don't Know Yet
- How many people installed NeoNova, and since when the store version carried the downloader (only version 1.4 is still available)
- What the payload did once it was running, and whether the server behind fortrana-update.com still hands it out
- Who is behind the “Abby Graceton” account that published the wallpaper on GitHub and the KDE Store
- Whether KDE and Pling will check other add-ons for the same trick
We will update this article when KDE or Pling publish more.
Our Mission
We believe security online security matters and its our mission to make it a safer place.